diff options
author | 2020-09-01 09:54:26 -0400 | |
---|---|---|
committer | 2020-09-01 09:54:26 -0400 | |
commit | a5c62dfa5955ad91aa6592c0a5443b93f8432bf3 (patch) | |
tree | 2b5fecafafbc8fafb1cab44d567385da059b483c /src | |
parent | shell none: avoid syscalls after seccomp_install_filters (diff) | |
download | firejail-a5c62dfa5955ad91aa6592c0a5443b93f8432bf3.tar.gz firejail-a5c62dfa5955ad91aa6592c0a5443b93f8432bf3.tar.zst firejail-a5c62dfa5955ad91aa6592c0a5443b93f8432bf3.zip |
removed --disable-seccomp from ./configure
Diffstat (limited to 'src')
-rw-r--r-- | src/common.mk.in | 4 | ||||
-rw-r--r-- | src/firejail/checkcfg.c | 12 | ||||
-rw-r--r-- | src/firejail/dbus.c | 2 | ||||
-rw-r--r-- | src/firejail/join.c | 2 | ||||
-rw-r--r-- | src/firejail/main.c | 9 | ||||
-rw-r--r-- | src/firejail/preproc.c | 2 | ||||
-rw-r--r-- | src/firejail/profile.c | 22 | ||||
-rw-r--r-- | src/firejail/protocol.c | 4 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 14 | ||||
-rw-r--r-- | src/firejail/seccomp.c | 3 | ||||
-rw-r--r-- | src/firejail/usage.c | 4 | ||||
-rw-r--r-- | src/include/seccomp.h | 17 |
12 files changed, 4 insertions, 91 deletions
diff --git a/src/common.mk.in b/src/common.mk.in index 8104bc258..4c4d0862c 100644 --- a/src/common.mk.in +++ b/src/common.mk.in | |||
@@ -9,8 +9,6 @@ sysconfdir=@sysconfdir@ | |||
9 | 9 | ||
10 | VERSION=@PACKAGE_VERSION@ | 10 | VERSION=@PACKAGE_VERSION@ |
11 | NAME=@PACKAGE_NAME@ | 11 | NAME=@PACKAGE_NAME@ |
12 | HAVE_SECCOMP_H=@HAVE_SECCOMP_H@ | ||
13 | HAVE_SECCOMP=@HAVE_SECCOMP@ | ||
14 | HAVE_CHROOT=@HAVE_CHROOT@ | 12 | HAVE_CHROOT=@HAVE_CHROOT@ |
15 | HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@ | 13 | HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@ |
16 | HAVE_NETWORK=@HAVE_NETWORK@ | 14 | HAVE_NETWORK=@HAVE_NETWORK@ |
@@ -34,7 +32,7 @@ BINOBJS = $(foreach file, $(OBJS), $file) | |||
34 | CFLAGS = @CFLAGS@ | 32 | CFLAGS = @CFLAGS@ |
35 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) | 33 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) |
36 | CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' | 34 | CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' |
37 | CFLAGS += $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_FIRETUNNEL) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) $(HAVE_SELINUX) | 35 | CFLAGS += $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) $(HAVE_SELINUX) |
38 | CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security | 36 | CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security |
39 | LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread | 37 | LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread |
40 | EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@ | 38 | EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@ |
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c index f6b3b3252..fb19e8f5a 100644 --- a/src/firejail/checkcfg.c +++ b/src/firejail/checkcfg.c | |||
@@ -226,7 +226,6 @@ int checkcfg(int val) { | |||
226 | 226 | ||
227 | // seccomp error action | 227 | // seccomp error action |
228 | else if (strncmp(ptr, "seccomp-error-action ", 21) == 0) { | 228 | else if (strncmp(ptr, "seccomp-error-action ", 21) == 0) { |
229 | #ifdef HAVE_SECCOMP | ||
230 | if (strcmp(ptr + 21, "kill") == 0) | 229 | if (strcmp(ptr + 21, "kill") == 0) |
231 | cfg_val[CFG_SECCOMP_ERROR_ACTION] = SECCOMP_RET_KILL; | 230 | cfg_val[CFG_SECCOMP_ERROR_ACTION] = SECCOMP_RET_KILL; |
232 | else if (strcmp(ptr + 21, "log") == 0) | 231 | else if (strcmp(ptr + 21, "log") == 0) |
@@ -239,9 +238,6 @@ int checkcfg(int val) { | |||
239 | config_seccomp_error_action_str = strdup(ptr + 21); | 238 | config_seccomp_error_action_str = strdup(ptr + 21); |
240 | if (!config_seccomp_error_action_str) | 239 | if (!config_seccomp_error_action_str) |
241 | errExit("strdup"); | 240 | errExit("strdup"); |
242 | #else | ||
243 | warning_feature_disabled("seccomp"); | ||
244 | #endif | ||
245 | } | 241 | } |
246 | 242 | ||
247 | else | 243 | else |
@@ -347,14 +343,6 @@ void print_compiletime_support(void) { | |||
347 | #endif | 343 | #endif |
348 | ); | 344 | ); |
349 | 345 | ||
350 | printf("\t- seccomp-bpf support is %s\n", | ||
351 | #ifdef HAVE_SECCOMP | ||
352 | "enabled" | ||
353 | #else | ||
354 | "disabled" | ||
355 | #endif | ||
356 | ); | ||
357 | |||
358 | printf("\t- SELinux support is %s\n", | 346 | printf("\t- SELinux support is %s\n", |
359 | #ifdef HAVE_SELINUX | 347 | #ifdef HAVE_SELINUX |
360 | "enabled" | 348 | "enabled" |
diff --git a/src/firejail/dbus.c b/src/firejail/dbus.c index 36d110ac7..f0ba10afc 100644 --- a/src/firejail/dbus.c +++ b/src/firejail/dbus.c | |||
@@ -555,10 +555,8 @@ void dbus_apply_policy(void) { | |||
555 | return; | 555 | return; |
556 | 556 | ||
557 | // --protocol=unix | 557 | // --protocol=unix |
558 | #ifdef HAVE_SECCOMP | ||
559 | if (cfg.protocol && !strstr(cfg.protocol, "unix")) | 558 | if (cfg.protocol && !strstr(cfg.protocol, "unix")) |
560 | return; | 559 | return; |
561 | #endif | ||
562 | 560 | ||
563 | fwarning("An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.\n"); | 561 | fwarning("An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.\n"); |
564 | } | 562 | } |
diff --git a/src/firejail/join.c b/src/firejail/join.c index c7619ef3b..7fd5ec3d3 100644 --- a/src/firejail/join.c +++ b/src/firejail/join.c | |||
@@ -465,10 +465,8 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
465 | EUID_ROOT(); | 465 | EUID_ROOT(); |
466 | if (apply_caps == 1) // not available for uid 0 | 466 | if (apply_caps == 1) // not available for uid 0 |
467 | caps_set(caps); | 467 | caps_set(caps); |
468 | #ifdef HAVE_SECCOMP | ||
469 | if (getuid() != 0) | 468 | if (getuid() != 0) |
470 | seccomp_load_file_list(); | 469 | seccomp_load_file_list(); |
471 | #endif | ||
472 | 470 | ||
473 | // mount user namespace or drop privileges | 471 | // mount user namespace or drop privileges |
474 | if (arg_noroot) { // not available for uid 0 | 472 | if (arg_noroot) { // not available for uid 0 |
diff --git a/src/firejail/main.c b/src/firejail/main.c index df890ecea..75324b66a 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -479,7 +479,6 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
479 | //************************************* | 479 | //************************************* |
480 | // independent commands - the program will exit! | 480 | // independent commands - the program will exit! |
481 | //************************************* | 481 | //************************************* |
482 | #ifdef HAVE_SECCOMP | ||
483 | else if (strcmp(argv[i], "--debug-syscalls") == 0) { | 482 | else if (strcmp(argv[i], "--debug-syscalls") == 0) { |
484 | if (checkcfg(CFG_SECCOMP)) { | 483 | if (checkcfg(CFG_SECCOMP)) { |
485 | int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSECCOMP_MAIN, "debug-syscalls"); | 484 | int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSECCOMP_MAIN, "debug-syscalls"); |
@@ -529,7 +528,6 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
529 | exit_err_feature("seccomp"); | 528 | exit_err_feature("seccomp"); |
530 | exit(0); | 529 | exit(0); |
531 | } | 530 | } |
532 | #endif | ||
533 | else if (strncmp(argv[i], "--profile.print=", 16) == 0) { | 531 | else if (strncmp(argv[i], "--profile.print=", 16) == 0) { |
534 | pid_t pid = require_pid(argv[i] + 16); | 532 | pid_t pid = require_pid(argv[i] + 16); |
535 | 533 | ||
@@ -950,7 +948,6 @@ void filter_add_blacklist_override(int fd, int syscall, int arg, void *ptrarg, b | |||
950 | (void) native; | 948 | (void) native; |
951 | } | 949 | } |
952 | 950 | ||
953 | #ifdef HAVE_SECCOMP | ||
954 | static int check_postexec(const char *list) { | 951 | static int check_postexec(const char *list) { |
955 | char *prelist, *postlist; | 952 | char *prelist, *postlist; |
956 | 953 | ||
@@ -961,7 +958,6 @@ static int check_postexec(const char *list) { | |||
961 | } | 958 | } |
962 | return 0; | 959 | return 0; |
963 | } | 960 | } |
964 | #endif | ||
965 | 961 | ||
966 | //******************************************* | 962 | //******************************************* |
967 | // Main program | 963 | // Main program |
@@ -1264,7 +1260,6 @@ int main(int argc, char **argv, char **envp) { | |||
1264 | else if (strcmp(argv[i], "--apparmor") == 0) | 1260 | else if (strcmp(argv[i], "--apparmor") == 0) |
1265 | arg_apparmor = 1; | 1261 | arg_apparmor = 1; |
1266 | #endif | 1262 | #endif |
1267 | #ifdef HAVE_SECCOMP | ||
1268 | else if (strncmp(argv[i], "--protocol=", 11) == 0) { | 1263 | else if (strncmp(argv[i], "--protocol=", 11) == 0) { |
1269 | if (checkcfg(CFG_SECCOMP)) { | 1264 | if (checkcfg(CFG_SECCOMP)) { |
1270 | if (cfg.protocol) { | 1265 | if (cfg.protocol) { |
@@ -1402,7 +1397,6 @@ int main(int argc, char **argv, char **envp) { | |||
1402 | } else | 1397 | } else |
1403 | exit_err_feature("seccomp"); | 1398 | exit_err_feature("seccomp"); |
1404 | } | 1399 | } |
1405 | #endif | ||
1406 | else if (strcmp(argv[i], "--caps") == 0) { | 1400 | else if (strcmp(argv[i], "--caps") == 0) { |
1407 | arg_caps_default_filter = 1; | 1401 | arg_caps_default_filter = 1; |
1408 | arg_caps_cmdline = 1; | 1402 | arg_caps_cmdline = 1; |
@@ -2783,10 +2777,9 @@ int main(int argc, char **argv, char **envp) { | |||
2783 | // check network configuration options - it will exit if anything went wrong | 2777 | // check network configuration options - it will exit if anything went wrong |
2784 | net_check_cfg(); | 2778 | net_check_cfg(); |
2785 | 2779 | ||
2786 | #ifdef HAVE_SECCOMP | ||
2787 | if (arg_seccomp) | 2780 | if (arg_seccomp) |
2788 | arg_seccomp_postexec = check_postexec(cfg.seccomp_list) || check_postexec(cfg.seccomp_list_drop); | 2781 | arg_seccomp_postexec = check_postexec(cfg.seccomp_list) || check_postexec(cfg.seccomp_list_drop); |
2789 | #endif | 2782 | |
2790 | bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec; | 2783 | bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec; |
2791 | if (need_preload && (cfg.seccomp_list32 || cfg.seccomp_list_drop32 || cfg.seccomp_list_keep32)) | 2784 | if (need_preload && (cfg.seccomp_list32 || cfg.seccomp_list_drop32 || cfg.seccomp_list_keep32)) |
2792 | fwarning("preload libraries (trace, tracelog, postexecseccomp due to seccomp.drop=execve etc.) are incompatible with 32 bit filters\n"); | 2785 | fwarning("preload libraries (trace, tracelog, postexecseccomp due to seccomp.drop=execve etc.) are incompatible with 32 bit filters\n"); |
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c index c0b09e945..836526593 100644 --- a/src/firejail/preproc.c +++ b/src/firejail/preproc.c | |||
@@ -103,7 +103,6 @@ void preproc_mount_mnt_dir(void) { | |||
103 | if (arg_tracefile) | 103 | if (arg_tracefile) |
104 | fs_tracefile(); | 104 | fs_tracefile(); |
105 | 105 | ||
106 | #ifdef HAVE_SECCOMP | ||
107 | create_empty_dir_as_root(RUN_SECCOMP_DIR, 0755); | 106 | create_empty_dir_as_root(RUN_SECCOMP_DIR, 0755); |
108 | 107 | ||
109 | if (arg_seccomp_block_secondary) | 108 | if (arg_seccomp_block_secondary) |
@@ -132,7 +131,6 @@ void preproc_mount_mnt_dir(void) { | |||
132 | create_empty_file_as_root(RUN_SECCOMP_POSTEXEC_32, 0644); | 131 | create_empty_file_as_root(RUN_SECCOMP_POSTEXEC_32, 0644); |
133 | if (set_perms(RUN_SECCOMP_POSTEXEC_32, getuid(), getgid(), 0644)) | 132 | if (set_perms(RUN_SECCOMP_POSTEXEC_32, getuid(), getgid(), 0644)) |
134 | errExit("set_perms"); | 133 | errExit("set_perms"); |
135 | #endif | ||
136 | } | 134 | } |
137 | } | 135 | } |
138 | 136 | ||
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 970033899..8eaae9a30 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -327,12 +327,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
327 | return 0; | 327 | return 0; |
328 | } | 328 | } |
329 | else if (strcmp(ptr, "seccomp") == 0) { | 329 | else if (strcmp(ptr, "seccomp") == 0) { |
330 | #ifdef HAVE_SECCOMP | ||
331 | if (checkcfg(CFG_SECCOMP)) | 330 | if (checkcfg(CFG_SECCOMP)) |
332 | arg_seccomp = 1; | 331 | arg_seccomp = 1; |
333 | else | 332 | else |
334 | warning_feature_disabled("seccomp"); | 333 | warning_feature_disabled("seccomp"); |
335 | #endif | ||
336 | return 0; | 334 | return 0; |
337 | } | 335 | } |
338 | else if (strcmp(ptr, "caps") == 0) { | 336 | else if (strcmp(ptr, "caps") == 0) { |
@@ -861,7 +859,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
861 | } | 859 | } |
862 | 860 | ||
863 | if (strncmp(ptr, "protocol ", 9) == 0) { | 861 | if (strncmp(ptr, "protocol ", 9) == 0) { |
864 | #ifdef HAVE_SECCOMP | ||
865 | if (checkcfg(CFG_SECCOMP)) { | 862 | if (checkcfg(CFG_SECCOMP)) { |
866 | if (cfg.protocol) { | 863 | if (cfg.protocol) { |
867 | fwarning("two protocol lists are present, \"%s\" will be installed\n", cfg.protocol); | 864 | fwarning("two protocol lists are present, \"%s\" will be installed\n", cfg.protocol); |
@@ -875,7 +872,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
875 | } | 872 | } |
876 | else | 873 | else |
877 | warning_feature_disabled("seccomp"); | 874 | warning_feature_disabled("seccomp"); |
878 | #endif | ||
879 | return 0; | 875 | return 0; |
880 | } | 876 | } |
881 | 877 | ||
@@ -890,102 +886,85 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
890 | 886 | ||
891 | // seccomp drop list on top of default list | 887 | // seccomp drop list on top of default list |
892 | if (strncmp(ptr, "seccomp ", 8) == 0) { | 888 | if (strncmp(ptr, "seccomp ", 8) == 0) { |
893 | #ifdef HAVE_SECCOMP | ||
894 | if (checkcfg(CFG_SECCOMP)) { | 889 | if (checkcfg(CFG_SECCOMP)) { |
895 | arg_seccomp = 1; | 890 | arg_seccomp = 1; |
896 | cfg.seccomp_list = seccomp_check_list(ptr + 8); | 891 | cfg.seccomp_list = seccomp_check_list(ptr + 8); |
897 | } | 892 | } |
898 | else if (!arg_quiet) | 893 | else if (!arg_quiet) |
899 | warning_feature_disabled("seccomp"); | 894 | warning_feature_disabled("seccomp"); |
900 | #endif | ||
901 | 895 | ||
902 | return 0; | 896 | return 0; |
903 | } | 897 | } |
904 | if (strncmp(ptr, "seccomp.32 ", 11) == 0) { | 898 | if (strncmp(ptr, "seccomp.32 ", 11) == 0) { |
905 | #ifdef HAVE_SECCOMP | ||
906 | if (checkcfg(CFG_SECCOMP)) { | 899 | if (checkcfg(CFG_SECCOMP)) { |
907 | arg_seccomp32 = 1; | 900 | arg_seccomp32 = 1; |
908 | cfg.seccomp_list32 = seccomp_check_list(ptr + 11); | 901 | cfg.seccomp_list32 = seccomp_check_list(ptr + 11); |
909 | } | 902 | } |
910 | else if (!arg_quiet) | 903 | else if (!arg_quiet) |
911 | warning_feature_disabled("seccomp"); | 904 | warning_feature_disabled("seccomp"); |
912 | #endif | ||
913 | 905 | ||
914 | return 0; | 906 | return 0; |
915 | } | 907 | } |
916 | 908 | ||
917 | if (strcmp(ptr, "seccomp.block-secondary") == 0) { | 909 | if (strcmp(ptr, "seccomp.block-secondary") == 0) { |
918 | #ifdef HAVE_SECCOMP | ||
919 | if (checkcfg(CFG_SECCOMP)) { | 910 | if (checkcfg(CFG_SECCOMP)) { |
920 | arg_seccomp_block_secondary = 1; | 911 | arg_seccomp_block_secondary = 1; |
921 | } | 912 | } |
922 | else | 913 | else |
923 | warning_feature_disabled("seccomp"); | 914 | warning_feature_disabled("seccomp"); |
924 | #endif | ||
925 | return 0; | 915 | return 0; |
926 | } | 916 | } |
927 | // seccomp drop list without default list | 917 | // seccomp drop list without default list |
928 | if (strncmp(ptr, "seccomp.drop ", 13) == 0) { | 918 | if (strncmp(ptr, "seccomp.drop ", 13) == 0) { |
929 | #ifdef HAVE_SECCOMP | ||
930 | if (checkcfg(CFG_SECCOMP)) { | 919 | if (checkcfg(CFG_SECCOMP)) { |
931 | arg_seccomp = 1; | 920 | arg_seccomp = 1; |
932 | cfg.seccomp_list_drop = seccomp_check_list(ptr + 13); | 921 | cfg.seccomp_list_drop = seccomp_check_list(ptr + 13); |
933 | } | 922 | } |
934 | else | 923 | else |
935 | warning_feature_disabled("seccomp"); | 924 | warning_feature_disabled("seccomp"); |
936 | #endif | ||
937 | return 0; | 925 | return 0; |
938 | } | 926 | } |
939 | if (strncmp(ptr, "seccomp.32.drop ", 13) == 0) { | 927 | if (strncmp(ptr, "seccomp.32.drop ", 13) == 0) { |
940 | #ifdef HAVE_SECCOMP | ||
941 | if (checkcfg(CFG_SECCOMP)) { | 928 | if (checkcfg(CFG_SECCOMP)) { |
942 | arg_seccomp32 = 1; | 929 | arg_seccomp32 = 1; |
943 | cfg.seccomp_list_drop32 = seccomp_check_list(ptr + 13); | 930 | cfg.seccomp_list_drop32 = seccomp_check_list(ptr + 13); |
944 | } | 931 | } |
945 | else | 932 | else |
946 | warning_feature_disabled("seccomp"); | 933 | warning_feature_disabled("seccomp"); |
947 | #endif | ||
948 | return 0; | 934 | return 0; |
949 | } | 935 | } |
950 | 936 | ||
951 | // seccomp keep list | 937 | // seccomp keep list |
952 | if (strncmp(ptr, "seccomp.keep ", 13) == 0) { | 938 | if (strncmp(ptr, "seccomp.keep ", 13) == 0) { |
953 | #ifdef HAVE_SECCOMP | ||
954 | if (checkcfg(CFG_SECCOMP)) { | 939 | if (checkcfg(CFG_SECCOMP)) { |
955 | arg_seccomp = 1; | 940 | arg_seccomp = 1; |
956 | cfg.seccomp_list_keep= seccomp_check_list(ptr + 13); | 941 | cfg.seccomp_list_keep= seccomp_check_list(ptr + 13); |
957 | } | 942 | } |
958 | else | 943 | else |
959 | warning_feature_disabled("seccomp"); | 944 | warning_feature_disabled("seccomp"); |
960 | #endif | ||
961 | return 0; | 945 | return 0; |
962 | } | 946 | } |
963 | if (strncmp(ptr, "seccomp.32.keep ", 13) == 0) { | 947 | if (strncmp(ptr, "seccomp.32.keep ", 13) == 0) { |
964 | #ifdef HAVE_SECCOMP | ||
965 | if (checkcfg(CFG_SECCOMP)) { | 948 | if (checkcfg(CFG_SECCOMP)) { |
966 | arg_seccomp32 = 1; | 949 | arg_seccomp32 = 1; |
967 | cfg.seccomp_list_keep32 = seccomp_check_list(ptr + 13); | 950 | cfg.seccomp_list_keep32 = seccomp_check_list(ptr + 13); |
968 | } | 951 | } |
969 | else | 952 | else |
970 | warning_feature_disabled("seccomp"); | 953 | warning_feature_disabled("seccomp"); |
971 | #endif | ||
972 | return 0; | 954 | return 0; |
973 | } | 955 | } |
974 | 956 | ||
975 | // memory deny write&execute | 957 | // memory deny write&execute |
976 | if (strcmp(ptr, "memory-deny-write-execute") == 0) { | 958 | if (strcmp(ptr, "memory-deny-write-execute") == 0) { |
977 | #ifdef HAVE_SECCOMP | ||
978 | if (checkcfg(CFG_SECCOMP)) | 959 | if (checkcfg(CFG_SECCOMP)) |
979 | arg_memory_deny_write_execute = 1; | 960 | arg_memory_deny_write_execute = 1; |
980 | else | 961 | else |
981 | warning_feature_disabled("seccomp"); | 962 | warning_feature_disabled("seccomp"); |
982 | #endif | ||
983 | return 0; | 963 | return 0; |
984 | } | 964 | } |
985 | 965 | ||
986 | // seccomp error action | 966 | // seccomp error action |
987 | if (strncmp(ptr, "seccomp-error-action ", 21) == 0) { | 967 | if (strncmp(ptr, "seccomp-error-action ", 21) == 0) { |
988 | #ifdef HAVE_SECCOMP | ||
989 | if (checkcfg(CFG_SECCOMP)) { | 968 | if (checkcfg(CFG_SECCOMP)) { |
990 | int config_seccomp_error_action = checkcfg(CFG_SECCOMP_ERROR_ACTION); | 969 | int config_seccomp_error_action = checkcfg(CFG_SECCOMP_ERROR_ACTION); |
991 | if (config_seccomp_error_action == -1) { | 970 | if (config_seccomp_error_action == -1) { |
@@ -1008,7 +987,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
1008 | } | 987 | } |
1009 | } else | 988 | } else |
1010 | warning_feature_disabled("seccomp"); | 989 | warning_feature_disabled("seccomp"); |
1011 | #endif | ||
1012 | return 0; | 990 | return 0; |
1013 | } | 991 | } |
1014 | 992 | ||
diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c index a1594d6b9..cd54eb72d 100644 --- a/src/firejail/protocol.c +++ b/src/firejail/protocol.c | |||
@@ -18,7 +18,6 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | 20 | ||
21 | #ifdef HAVE_SECCOMP | ||
22 | #include "firejail.h" | 21 | #include "firejail.h" |
23 | #include "../include/seccomp.h" | 22 | #include "../include/seccomp.h" |
24 | 23 | ||
@@ -93,6 +92,3 @@ void protocol_print_filter(pid_t pid) { | |||
93 | exit(1); | 92 | exit(1); |
94 | #endif | 93 | #endif |
95 | } | 94 | } |
96 | |||
97 | |||
98 | #endif // HAVE_SECCOMP | ||
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 5a4741a56..3bb4858c9 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -141,7 +141,6 @@ void set_apparmor(void) { | |||
141 | } | 141 | } |
142 | #endif | 142 | #endif |
143 | 143 | ||
144 | #ifdef HAVE_SECCOMP | ||
145 | void seccomp_debug(void) { | 144 | void seccomp_debug(void) { |
146 | if (arg_debug == 0) | 145 | if (arg_debug == 0) |
147 | return; | 146 | return; |
@@ -158,7 +157,6 @@ void seccomp_debug(void) { | |||
158 | printf("No active seccomp files\n"); | 157 | printf("No active seccomp files\n"); |
159 | EUID_ROOT(); | 158 | EUID_ROOT(); |
160 | } | 159 | } |
161 | #endif | ||
162 | 160 | ||
163 | static void save_nogroups(void) { | 161 | static void save_nogroups(void) { |
164 | if (arg_nogroups == 0) | 162 | if (arg_nogroups == 0) |
@@ -497,9 +495,7 @@ void start_application(int no_sandbox, char *set_sandbox_status) { | |||
497 | #ifdef HAVE_GCOV | 495 | #ifdef HAVE_GCOV |
498 | __gcov_dump(); | 496 | __gcov_dump(); |
499 | #endif | 497 | #endif |
500 | #ifdef HAVE_SECCOMP | ||
501 | seccomp_install_filters(); | 498 | seccomp_install_filters(); |
502 | #endif | ||
503 | if (set_sandbox_status) | 499 | if (set_sandbox_status) |
504 | *set_sandbox_status = SANDBOX_DONE; | 500 | *set_sandbox_status = SANDBOX_DONE; |
505 | execl(arg_audit_prog, arg_audit_prog, NULL); | 501 | execl(arg_audit_prog, arg_audit_prog, NULL); |
@@ -536,9 +532,8 @@ void start_application(int no_sandbox, char *set_sandbox_status) { | |||
536 | #ifdef HAVE_GCOV | 532 | #ifdef HAVE_GCOV |
537 | __gcov_dump(); | 533 | __gcov_dump(); |
538 | #endif | 534 | #endif |
539 | #ifdef HAVE_SECCOMP | ||
540 | seccomp_install_filters(); | 535 | seccomp_install_filters(); |
541 | #endif | 536 | |
542 | if (set_sandbox_status) | 537 | if (set_sandbox_status) |
543 | *set_sandbox_status = SANDBOX_DONE; | 538 | *set_sandbox_status = SANDBOX_DONE; |
544 | execvp(cfg.original_argv[cfg.original_program_index], &cfg.original_argv[cfg.original_program_index]); | 539 | execvp(cfg.original_argv[cfg.original_program_index], &cfg.original_argv[cfg.original_program_index]); |
@@ -591,9 +586,8 @@ void start_application(int no_sandbox, char *set_sandbox_status) { | |||
591 | #ifdef HAVE_GCOV | 586 | #ifdef HAVE_GCOV |
592 | __gcov_dump(); | 587 | __gcov_dump(); |
593 | #endif | 588 | #endif |
594 | #ifdef HAVE_SECCOMP | ||
595 | seccomp_install_filters(); | 589 | seccomp_install_filters(); |
596 | #endif | 590 | |
597 | if (set_sandbox_status) | 591 | if (set_sandbox_status) |
598 | *set_sandbox_status = SANDBOX_DONE; | 592 | *set_sandbox_status = SANDBOX_DONE; |
599 | execvp(arg[0], arg); | 593 | execvp(arg[0], arg); |
@@ -797,7 +791,6 @@ int sandbox(void* sandbox_arg) { | |||
797 | // - build seccomp filters | 791 | // - build seccomp filters |
798 | // - create an empty /etc/ld.so.preload | 792 | // - create an empty /etc/ld.so.preload |
799 | //**************************** | 793 | //**************************** |
800 | #ifdef HAVE_SECCOMP | ||
801 | if (cfg.protocol) { | 794 | if (cfg.protocol) { |
802 | if (arg_debug) | 795 | if (arg_debug) |
803 | printf("Build protocol filter: %s\n", cfg.protocol); | 796 | printf("Build protocol filter: %s\n", cfg.protocol); |
@@ -808,7 +801,6 @@ int sandbox(void* sandbox_arg) { | |||
808 | if (rv) | 801 | if (rv) |
809 | exit(rv); | 802 | exit(rv); |
810 | } | 803 | } |
811 | #endif | ||
812 | 804 | ||
813 | // need ld.so.preload if tracing or seccomp with any non-default lists | 805 | // need ld.so.preload if tracing or seccomp with any non-default lists |
814 | bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec; | 806 | bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec; |
@@ -1107,7 +1099,6 @@ int sandbox(void* sandbox_arg) { | |||
1107 | save_cgroup(); | 1099 | save_cgroup(); |
1108 | 1100 | ||
1109 | // set seccomp | 1101 | // set seccomp |
1110 | #ifdef HAVE_SECCOMP | ||
1111 | // install protocol filter | 1102 | // install protocol filter |
1112 | #ifdef SYS_socket | 1103 | #ifdef SYS_socket |
1113 | if (cfg.protocol) { | 1104 | if (cfg.protocol) { |
@@ -1151,7 +1142,6 @@ int sandbox(void* sandbox_arg) { | |||
1151 | // make seccomp filters read-only | 1142 | // make seccomp filters read-only |
1152 | fs_remount(RUN_SECCOMP_DIR, MOUNT_READONLY, 0); | 1143 | fs_remount(RUN_SECCOMP_DIR, MOUNT_READONLY, 0); |
1153 | seccomp_debug(); | 1144 | seccomp_debug(); |
1154 | #endif | ||
1155 | 1145 | ||
1156 | // set capabilities | 1146 | // set capabilities |
1157 | set_caps(); | 1147 | set_caps(); |
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c index 7f55ccc0e..e47e6c910 100644 --- a/src/firejail/seccomp.c +++ b/src/firejail/seccomp.c | |||
@@ -18,7 +18,6 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | 20 | ||
21 | #ifdef HAVE_SECCOMP | ||
22 | #include "firejail.h" | 21 | #include "firejail.h" |
23 | #include "../include/seccomp.h" | 22 | #include "../include/seccomp.h" |
24 | #include <sys/mman.h> | 23 | #include <sys/mman.h> |
@@ -445,5 +444,3 @@ errexit: | |||
445 | printf("Cannot access seccomp filter.\n"); | 444 | printf("Cannot access seccomp filter.\n"); |
446 | exit(1); | 445 | exit(1); |
447 | } | 446 | } |
448 | |||
449 | #endif // HAVE_SECCOMP | ||
diff --git a/src/firejail/usage.c b/src/firejail/usage.c index 2390706f2..d58bbb409 100644 --- a/src/firejail/usage.c +++ b/src/firejail/usage.c | |||
@@ -123,10 +123,8 @@ static char *usage_str = | |||
123 | " --mac=xx:xx:xx:xx:xx:xx - set interface MAC address.\n" | 123 | " --mac=xx:xx:xx:xx:xx:xx - set interface MAC address.\n" |
124 | #endif | 124 | #endif |
125 | " --machine-id - preserve /etc/machine-id\n" | 125 | " --machine-id - preserve /etc/machine-id\n" |
126 | #ifdef HAVE_SECCOMP | ||
127 | " --memory-deny-write-execute - seccomp filter to block attempts to create\n" | 126 | " --memory-deny-write-execute - seccomp filter to block attempts to create\n" |
128 | "\tmemory mappings that are both writable and executable.\n" | 127 | "\tmemory mappings that are both writable and executable.\n" |
129 | #endif | ||
130 | #ifdef HAVE_NETWORK | 128 | #ifdef HAVE_NETWORK |
131 | " --mtu=number - set interface MTU.\n" | 129 | " --mtu=number - set interface MTU.\n" |
132 | #endif | 130 | #endif |
@@ -215,7 +213,6 @@ static char *usage_str = | |||
215 | #ifdef HAVE_NETWORK | 213 | #ifdef HAVE_NETWORK |
216 | " --scan - ARP-scan all the networks from inside a network namespace.\n" | 214 | " --scan - ARP-scan all the networks from inside a network namespace.\n" |
217 | #endif | 215 | #endif |
218 | #ifdef HAVE_SECCOMP | ||
219 | " --seccomp - enable seccomp filter and apply the default blacklist.\n" | 216 | " --seccomp - enable seccomp filter and apply the default blacklist.\n" |
220 | " --seccomp=syscall,syscall,syscall - enable seccomp filter, blacklist the\n" | 217 | " --seccomp=syscall,syscall,syscall - enable seccomp filter, blacklist the\n" |
221 | "\tdefault syscall list and the syscalls specified by the command.\n" | 218 | "\tdefault syscall list and the syscalls specified by the command.\n" |
@@ -229,7 +226,6 @@ static char *usage_str = | |||
229 | " --seccomp.32[.drop,.keep][=syscall] - like above but for 32 bit architecture.\n" | 226 | " --seccomp.32[.drop,.keep][=syscall] - like above but for 32 bit architecture.\n" |
230 | " --seccomp-error-action=errno|kill|log - change error code, kill process\n" | 227 | " --seccomp-error-action=errno|kill|log - change error code, kill process\n" |
231 | "\tor log the attempt.\n" | 228 | "\tor log the attempt.\n" |
232 | #endif | ||
233 | " --shell=none - run the program directly without a user shell.\n" | 229 | " --shell=none - run the program directly without a user shell.\n" |
234 | " --shell=program - set default user shell.\n" | 230 | " --shell=program - set default user shell.\n" |
235 | " --shutdown=name|pid - shutdown the sandbox identified by name or PID.\n" | 231 | " --shutdown=name|pid - shutdown the sandbox identified by name or PID.\n" |
diff --git a/src/include/seccomp.h b/src/include/seccomp.h index 29b858c70..90db16d39 100644 --- a/src/include/seccomp.h +++ b/src/include/seccomp.h | |||
@@ -96,24 +96,7 @@ | |||
96 | # define PR_SET_NO_NEW_PRIVS 38 | 96 | # define PR_SET_NO_NEW_PRIVS 38 |
97 | #endif | 97 | #endif |
98 | 98 | ||
99 | #if HAVE_SECCOMP_H | ||
100 | #include <linux/seccomp.h> | 99 | #include <linux/seccomp.h> |
101 | #else | ||
102 | #define SECCOMP_MODE_FILTER 2 | ||
103 | #define SECCOMP_RET_KILL 0x00000000U | ||
104 | #define SECCOMP_RET_TRAP 0x00030000U | ||
105 | #define SECCOMP_RET_ALLOW 0x7fff0000U | ||
106 | #define SECCOMP_RET_ERRNO 0x00050000U | ||
107 | #define SECCOMP_RET_DATA 0x0000ffffU | ||
108 | |||
109 | struct seccomp_data { | ||
110 | int nr; | ||
111 | __u32 arch; | ||
112 | __u64 instruction_pointer; | ||
113 | __u64 args[6]; | ||
114 | }; | ||
115 | #endif | ||
116 | |||
117 | #ifndef SECCOMP_RET_LOG | 100 | #ifndef SECCOMP_RET_LOG |
118 | #define SECCOMP_RET_LOG 0x7ffc0000U | 101 | #define SECCOMP_RET_LOG 0x7ffc0000U |
119 | #endif | 102 | #endif |